We are migrating to KeyCloak for an existing Java project. I see the option to set "includeKeyInfoInSignature = false" in the XMLSignatureUtil class, however the behavior is not what I expected. Per the spec at
https://www.w3.org/TR/xmldsig-core/#sec-KeyInfo the entire KeyInfo element is optional. So if I set includeKeyInfoInSignature = false and pass null for keyName in the sign method, I am expecting that there would NOT be a keyInfo XML element generated. Instead the util class will throw an IllegalArgumentException?
The createKeyInfo method properly checks for a null, and the fac.newXMLSignature(si, ki); method in XMLSignatureUtil indicates that null is valid for the ki element. So having the createKeyInfo method throw an error when the items are empty seems incorrect when trying to exclude KeyInfo in the signature?
I would expect that either the createKeyInfo method (XMLSignatureUtil.java line 790) would return a null if all parameters are null, OR the includeKeyInfoInSignature logic around lines 783 would be modified to only call the createKeyInfo method if keyName is not null.
Is this a bug, or is there some specific business reason or change to the specification that I'm missing?
Thanks!
-Joe